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3 June 1981 


SUBJECT: Accounting of Disclosures of Records Made to Persons 
oer Entities Outside the Central Intelligence Agency 
(CIA) 


REFERENCE: Memo fm OGC dtd 26 May 81, same subject (OGC 8381-04296) 


dn The Office of Data Processing (ODP) maintains five systems 
of records subject to the Privacy Act and reported in the Federal 
Register. Contractual relationships with hardware and software 
vendors providing services to CIA make it necessary for us to 
disclose information contained in these systems to contractors’ 
representatives. ODP does not currently keep any purposeful or 
complete accounting of these disclosures. To do so would entail an 
unwarranted burden in carrying out legitimate administrative 
correspondence with contractors for the reasons stated below. 


Ze ODP makes no disclosures outside of CIA from two of its 
Privacy Systems, the ODP Training Records System and ODP's Computer 
Access Files. The first of these systems is used to keep track of 
the Agency-sponsored training completed by ODP employees. It is a 
computerized ready~reference data base used for local administra- 
tive functions in ODP. No disclosures outside of CIA are necessary 
or proper because the Office of Training and Education maintains 
the official record for each employee. . 


3. The second system, the Computer Access File, records the 
User Identification (USERID) and Password of every person who has 
access to an ODP computer through a terminal. This information is 
used for CIA internal security management and is therefore not 
disclosed outside CIA, STATINTL 


4, Information concerning employees who are working or plan 
to work for a contractor, @.4., etc. on an ODP 
contract, is maintained in the ree remaining Privacy Systems. 


The first of these, the Applications Tracking System, keeps track 
of, amonq other things, the hours expended by staff or contractor 
employees on an ODP project. This data base is used as an 
authority file for charging ODP customers through a Project 
Activity Report (PAR) for the man-hours expended on an ODP project 
done for them. It is also used to verify the invoices of con- 
tractors for billeé man-hours. This verification frequently 
requires a Contracting Officer's Technical Representative (COTR) to 
discuss with a Contractor's Representative the contents of this 
system of records regarding the hours reported by «a contractor's 
employee. Because there are several COTR's in ODP with authorized 
access to the system, no accounting is kept of such disclosures. 
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''o do so would require a single point of contact who would record 
each disclosure in a manual or computer-based log. This would not 
be impossible, but it seems hardly warranted by the type of 
disclosure concerned, 


5. The second file from which disclosures are made to 
contractors, again by COTR's and also by ODP's Security Officer and 
Assistant, is ODP's Security Clearance Records. This file keeps 
track of the security clearances and compartmented accesses 
requested, in process, or granted to contractor employees. 
Frequent dialogue occurs between ODP emplovees and contractors! 
representatives about the status of clearances requested for 
contractcrs' employees. Again, no accounting is kept of these 
discussions. Toa gain the control necessary to do so would require 
that the Security Officer be the single person authorized to 
discuss clearances with contractors. Such a bottleneck would 
hamper relations with contractors. 


6. fhe third opr file from which disclosures are made to 
contractors, usually only by the Security Officer or Assistant, is 
ODP's Computer Room Access File. This file keeps track of which 
employees, Agency and contractor, have been authorized to enter ODP 
computer rooms. This information is used to request Special Badge 
Indicators from the Office of Security and to provide the computer 
centers with a list of authorized personnel. Contractors occa- 
sionally want to know whether one of their employees has access to 
a particular computer center. {This is true especially of computer 
maintenance personnel.) ODP has not placed any restrictions on who 
in ODP can provide a contractor with this information. Such re- 
striction would be prerequisite to establishing an accurate 
accounting of this type of disclosure. 


Te Without a clear definition of what constitutes a 
disclosure, ODP would find it difficult to decide what should be 
accounted for. ODP has taken the view that the information being 
discussed (disclosed) with contractors in the situations described 
above is necessary to the proper conduct of contractual business 
and therefore not subject to the accounting provisions of the 
Privacy Act. ODP's Jine of reasoning has been that the contractor, 
through a contractual relationship with CIA, becomes an extension 
of the Agency. Therefore, routine disclosures to contractor 
employees do not require accounting under the Privacy Act. 
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OGC 81-04296 
26 May 1981 


MEMORANDUM FOR: See Distribution 


) 


FROM : 
STATINTL Office of General Counsel 
SUBJECT : Accounting Of Disclosures Of Records 


Made To Persons Or Entities Outside 
The Central Intelligence Agency (CIA) 


1. To aid in a review of recordkeeping practices 
relating to systems of records maintained by the Agency (as 
defined under the Privacy Act), this Office needs to deter- 
mine to what extent an accounting has been or is being 
maintained for each disclosure of records made to persons 
or entities outside the Central Intelligence Agency. 
Accordingly, it is requested that you provide this Office 
with a brief description of the system of accounting used 
for such disclosures made from records systems under your 
cognizance. If no such accounting has been or is being 
maintained, then you should provide this Office with a 
brief evaluation of what technical steps, manpower needs 
and financial costs would be required to establish and 
maintain such a system of accounting. (In drafting your 
evaluation, assume the system of account will have to 
accurately record: (1) the date, nature and purpose of 
each such disclosure, and (2) the name and address of each 
person or entity to whom such a disclosure is made. Use 
your own professional judgment whether such a system of 
accounting can or should be automated or manual.) 


2. This Office would appreciate receiving a response 
to this inquiry by no later than the close of business on 5 
June 1981. Please feel free to call me (7521-black; 9336- 
red; 8255-gray) if you have any questions about this 
matter. STATINTL 


Approved For Release 2001/09/03 : CIA-RDP84-00933R000400070006-7 


” & Soe. ob & 


oan . Approved Fou Release 2001/09/03 : CIA-RDP84-0093@xr000400070006-7 


DISTRIBUTION: 


General Counsel 
Legislative Counsel 
Inspector General 
Director of Personnel 
Director of Equal Employment Opportunity 
Director of Public Affairs 
Executive Assistant to the DCI 
Executive Secretary 
Director of Central Reference 
Director of Economic Research 
Director of Geographic & Cartographic Research 
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Director of Training & Education 
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Chief, Support Staff, Intelligence Community Staff 
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Chief, Career Management Staff/DDO 
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MEMORANDUM FOR: See Distribution on a 
FROM : 
Office of General Counsel 
SUBJECT : Accounting Of Disclosures Of Records 


Made To Persons Or Entities Outside 
The Central Intelligence Agency (CIA) 


1. To aid in a review of recordkeeping practices 
relating to systems of records maintained by the Agency (as 
defined under the Privacy Act), this Office needs to deter- 
mine to what extent an accounting has been or is being 
: maintained for each disclosure of records made to persons 
4 or entities outside the Central Intelligence Agency. 

“ Accordingly, it is requested that you provide this Office 
With a brief description of the system of accounting used 
for such disclosures made from records systems under your 

| cognizance. If no such accounting has been or is being 

i maintained, then you should provide this Office with a 

brief evaluation of what technical steps, manpower needs 
and financial costs would be required to establish and 

I maintain such a system of accounting. (In drafting your 

evaluation, assume the system of account will have to 

accurately record: (1) the date, nature and purpose of 
each such disclosure, and (2) the name and address of each 
person or entity to whom such a disclosure is made. Use 
your own professional judgment whether such a system of 
accounting can or should be automated or manual.) 


om cme = ALUM LAL ULI 


2. This Office would appreciate receiving a response 
to this inquiry by no later than the close of business on 5 
June 1981. Please feel free to call me (7521-black; 9336- 
red; 8255-gray) if you have any questions about this 
matter. 


STATINTL 
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‘ROUTING AND RECORD SHEET 
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Esquire 
Office of General. Counsel 
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